First-tier Tribunal (General Regulatory Chamber)

Appeal number:  CMS 2019/0001             

 

 

FIRST-TIER TRIBUNAL

GENERAL REGULATORY CHAMBER

CLAIMS MANAGEMENT REGULATION

 

 

 

	HALL AND HANLEY LIMITED	Appellant
	- and -
	THE FINANCIAL CONDUCT AUTHORITY	Respondent

 

 

 

TRIBUNAL:	JUDGE TIMOTHY HERRINGTON MR PETER FREEMAN

 

 

 

 

 

Sitting in public at Field House, 15-25 Bream’s Buildings London EC4A 1DZ on 6 and 7 November 2019

 

 

Jonathan Stirland, Solicitor, instructed by Short Richardson, & Forth, Solicitors, for the Appellant

 

Ewan West, Counsel, instructed by the Financial Conduct Authority, for the Respondent

 

 

 

 

 

 

 

DECISION

 

 

1.              The appeal is dismissed.

 

                                                            REASONS

Introduction

2.              The appellant company (“H&H”) has appealed against the decision of the Claims Management Regulator (“CMR”) dated 5 March 2019 (“the Decision”) that it had failed to comply with the conditions of its authorisation and the imposition of a financial penalty of £91,000.

3.              From 1 April 2019, claims management services have been regulated by the Financial Conduct Authority (the “Authority”) and the CMR has ceased to exist. Pursuant to Article 65 of the Financial Services and Markets Act 2000 Claims Management Activity) Order 2018, because H & H had submitted its notice of appeal against the Decision to this Tribunal prior to 1 April 2019 and the appeal had not been determined by that date the appeal proceeds as though the Authority had made the relevant decision and for that purpose the Authority has been substituted for CMR as the respondent to this appeal.

4.              The applicable legislation in force at the relevant time in relation to the matters under appeal was that governing CMR and accordingly in this decision we will refer solely to CMR and the relevant regulatory requirements laid down by that body in respect of the matters under appeal when referring to the actions taken.

5.              In summary, CMR decided that H & H had failed to comply with the conditions of its authorisation in that it had failed to comply with the Conduct of Authorised Persons Rules 2014 (the “2014 Rules”).

6.              In particular, CMR decided that H & H had failed to conduct sufficient due diligence as regards data it purchased from two entities for the purpose of making telemarketing calls to potential customers and that those failings led to H & H purchasing data that had been generated in breach of Regulation 22 of The Privacy and Electronic Communications Regulations 2003 (“PECR”). CMR contended that in that regard H & H had not followed previous advice given by CMR, demonstrating a pattern of misconduct, and had ignored specific advice CMR had provided regarding data that had been generated using one particular website. It therefore it appeared to CMR that H & H was intentionally or recklessly in breach of the 2014 Rules, in particular General Rule 2 of the 2014 Rules which required, inter-alia, businesses regulated by CMR to take all reasonable steps in relation to any arrangements with third parties to confirm that any referrals, leads or data have been obtained in accordance with the requirements of the legislation and Rules.

7.              CMR also decided, following concerns that lenders to whom claims in respect of payment protection insurance (“ PPI”) had been submitted on behalf of certain of H & H’s customers may have been supplied with letters of authority on which signatures had been forged, that in a number of cases signatures were forged on letters of authority by copying signatures from other documents in the possession of H & H. CMR said in the Decision that because this issue related to half the files it had reviewed, the issue was likely to be widespread in H & H’s business practices and had the potential to cause detriment to clients. CMR therefore decided that H & H had acted in breach of General Rule 2 which, inter-alia, required a business to make representations to a third party that substantiate and evidence the basis of a claim to be specific to each claim and not fraudulent, false or misleading and Client Specific Rule 1 which requires a business to act fairly and reasonably in dealings with all clients.

8.              CMR decided that these failings justified the imposition of a financial penalty. A financial penalty of £91,000 was calculated by reference to H & H’s turnover in the relevant period and by assessing the nature and seriousness of the breaches by reference to CMR’s guidance on financial penalties.

9.              H & H disputes CMR’s assessment that it was in breach of the Rules in the manner contended by CMR. It contends that the proposed financial penalty of £91,000 is inappropriate and unwarranted as H & H has taken all reasonable steps to comply with its conditions of authorisation and the 2014 Rules. It also contends that CMR failed to follow its own enforcement policy, in that there were other more appropriate enforcement actions available and further, and in the alternative, that CMR failed to properly apply its financial penalties guidance in assessing the amount of the financial penalty.

Relevant legal and regulatory provisions and guidance

10.           We set out below the relevant legal and regulatory provisions and guidance which applied at the times relevant to this appeal.

Authorisation requirements

11.           Section 4 (1) of the Compensation Act 2006 (“CA 2006”) provided that a person may not provide claims management services in the course of a business unless, generally speaking, he was authorised by CMR to do so. Pursuant to Article 4 of The Compensation (Regulated Claims Management Services) Order 2006 the kinds of service prescribed as claims management services included advertising for, or otherwise seeking out (for example, by canvassing or direct marketing) persons who may have a cause of action and also include referring for or in expectation of a fee, gain or reward details of a claim or claimant, or a cause of action or potential claimant, to another person.

12.           It is common ground that at the time of the Decision H&H was providing claims management services in the course of its business and was required to be authorised.

13.           The Compensation (Claims Management Services) Regulations 2006 (the “2006 Regulations”), among other things, deal with the manner in which a person may become authorised to provide claims management services and the requirements to be satisfied before such an authorisation may be granted.

14.           Regulation 12 of the 2006 Regulations provided that CMR may grant an authorisation subject to a condition or conditions. Those conditions may, among other things, relate to the way in which the person provides the service for which he is authorised.

 Regulation 12 (5) of the 2006 Regulations provided that in addition to any conditions imposed by CMR, it was a condition of any authorised person’s authorisation that, among other things, the person complied with the rules prescribed by CMR and that if the person accepts referrals of potential clients from another person the authorised person takes reasonable steps to ensure that the other person obtains the business in a way consistent with the rules.

Conduct provisions

15.           Pursuant to the power contained in Regulation 22 of the 2006 Regulations, on 1 October 2014 CMR made rules governing the conduct of authorised persons in the form of the 2014 Rules. Those rules were replaced by the Conduct of Authorised Persons Rules 2018 with effect from 1 April 2018. During the period which is relevant to this decision, H & H would therefore have been subject to the 2014 Rules.

16.           The 2014 Rules imposed what were known as (i) the General Rules (“GR”) and (ii) the Client Specific Rules (“CSR”) which all authorised claims management companies were required to adhere to.

17.           GR 2 provided so far as relevant as follows:

“A business shall conduct itself responsibly overall including, but not limited to, acting with professional diligence and carry out the following:

…

(b) Make representations to a third party that substantiates and evidence the basis of the claim, are specific to each claim and are not fraudulent, false or misleading.

…

(e) Take all reasonable steps in relation to any arrangement with third parties to confirm that any referrals, leads or data have been obtained in accordance with the requirements of the legislation and Rules.”

 

18.           CSR 1(a) provided so far as relevant as follows:

“1. A business shall –

…

         (a) Act fairly and reasonably in dealings with all clients.”

…”

Data protection

19.           Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) deals with the use of electronic mail for direct marketing purposes as follows:

“(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers.

  (2)  Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.

(3)  A person may send or instigate the sending of electronic mail for the purposes of direct marketing where–

(a)  that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient;

(b)  the direct marketing is in respect of that person’s similar products and services only; and

(c)  the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.

(4)  A subscriber shall not permit his line to be used in contravention of paragraph (2).”

20.           GR 15 provided that:

“15. If required to do so the business must be registered with the Information Commissioner’s Office and comply with all relevant data protection legislation.”

21.           Guidance as to how to conduct direct marketing without infringing relevant data protection legislation was available during the times that are relevant for the purposes of this decision from the Information Commissioner’s Office (“ICO”). In particular, the ICO issued guidance in 2013 which was revised in May 2016. That guidance dealt, among other things, with the question of when an individual has validly given consent to receiving marketing from third-party organisations in circumstances where it tells one organisation that they consent to such marketing, known as indirect or third party consent.

22.           The 2013 guidance dealt specifically with indirect consent in the context of the sending of texts, emails or automated calls at paragraphs 76 to 79 as follows:

“76. Although there is a well-established trade in third party opt-in lists for traditional forms of marketing, organisations need to be aware that indirect consent might not be enough for texts, emails or automated calls. This is because the rules on electronic marketing are stricter, to reflect the more intrusive nature of electronic messages. PECR specifically requires that the customer has notified the sender that they consent to messages from them: see the definition of consent above. On a strict interpretation, indirect consent would not meet this test – as the customer did not directly notify the sender, they notified someone else. Therefore, it is best practice for an organisation to only send marketing text and emails, or make automated calls to individuals, if it obtained consent directly from that person.

77. However, we do accept that indirect consent might be valid in some circumstances, if it is clear and specific enough. In essence, the customer must have anticipated that their details would be passed to the organisation in question, and that they were consenting to messages from that organisation. This will depend on what exactly they were told when consent was obtained.

…

79. Indirect consent may therefore be valid if that organisation was specifically named, or if the consent described a specific category of organisations and it clearly falls within that description. But if the consent was more general – e.g. to marketing “from selected third parties” – it will be very difficult to demonstrate valid consent to a call, text or email if someone complains.”

23.           The 2016 guidance was in similar terms, as set out at paragraphs 83 to 89. However, what was said at paragraph 79 of the 2013 guidance was expanded upon at paragraphs 88 and 89 of the 2016 guidance as follows:

“88. Indirect consent may therefore be valid if that organisation was specifically named. But if the consent was more general (e.g. marketing from “selected third parties”) this will not demonstrate valid consent to marketing calls, text or emails.

89. However, indirect consent could also be valid if the consent very clearly described precisely defined categories of organisations and the organisation wanting to use the consent clearly falls within that description. Consent is not likely to be valid where an individual is presented with a long, seemingly exhaustive list, of general categories of organisations. The names of the categories used must be tightly defined and understandable to individuals. In practice, this means that the categories of companies need to be sufficiently specific that individuals could reasonably foresee the types of companies that they would be receiving marketing from, how they would receive that marketing and what that marketing would be.”

Investigation and enforcement powers

24.           Regulation 35 of the 2006 Regulations gave CMR the power to investigate the conduct of an authorised person if CMR was satisfied that there were reasonable grounds to suspect that the authorised person has failed to comply with a condition of authorisation and the alleged or suspected breach is serious enough to justify an investigation.

25.           Regulation 48 of the 2006 Regulations provided that if, after investigation of an alleged or suspected failure by an authorised person to comply with a condition of authorisation that applies by virtue of Regulation 12 (5) of the 2006 Regulations, CMR was satisfied that the authorised person had failed to comply with the condition CMR may require the authorised person to pay a penalty.

26.           Regulation 49 of the 2006 Regulations made provision for the determination of the amount of a penalty as follows:

“(1)  [CMR] must determine the amount of any penalty that an authorised person is required to pay under regulation 48 in accordance with this regulation and regulation 50.

(2)  The amount of the penalty must be—

(a)  for an authorised person whose business has a relevant turnover of less than £500,000, no more than £100,000;

(b)  for an authorised person whose business has a relevant turnover of £500,000 or more, no more than 20 per cent of that turnover.

(3)  The amount of the penalty may be the same as or greater or less than the proposed amount set out in the notice under regulation 51(1)(b).

(4)  When determining the amount of the penalty that an authorised person is required to pay under regulation 48(1), (2) or (4) [CMR] must have regard to—

(a)  the nature and seriousness of the acts or omissions giving rise to [CMR’s] decision to exercise the power to require the authorised person to pay a penalty; and

(b)  the relevant turnover of the business of the authorised person.”

27.           Regulation 50 set out the basis on which “relevant turnover” was to be calculated as follows:

(1)  In this Part “relevant turnover” means the figure determined by [CMR] with this regulation.

(2) [CMR] must determine such figure as [CMR] considers appropriate for the turnover of the business of the authorised person.

(3)  The turnover to be determined is the turnover of the authorised person's business from regulated claims management services.

(4)  The turnover to be determined is for the period of 12 months prior to the date on which [CMR] gives the notice under regulation 51(1).

(5)  When determining the relevant turnover of an authorised person under this regulation [CMR] must have regard to—

(a)  any figure for the annual turnover or the expected annual turnover used by [CMR] for the purposes of calculating the authorised person's most recent fee for authorisation;

(b)  any more up to date information on turnover.

(6)  When determining the relevant turnover of an authorised person under this regulation [CMR] may estimate amounts.”

28.           Regulation 51 of the 2006 Regulations required CMR, inter-alia, before requiring an authorised person to pay a penalty, to give written notice to the authorised person stating that CMR proposed to require the authorised person to pay a penalty and setting out the proposed amount of the penalty. This notice was commonly referred to as a “minded to letter”.

29.            Regulation 52 of the 2006 Regulations required CMR to take account of any written representations made by the authorised person in respect of the proposal to impose a penalty.

30.           In December 2014 CMR published its Enforcement Policy which provided guidance regarding CMR’s approach to enforcement and in particular guidance as to when CMR was likely to use informal enforcement action including advice, letters of warning and written undertakings, or formal enforcement action including the issuance of directions, the imposition of a financial penalty or the variation, suspension or cancellation of authorisation.

31.           As regards advice, paragraph 3.1 of the policy stated:

“Before deciding to adopt this course of action, [CMR] will need to be satisfied:

-          that the authorised… person will remedy the situation, without formal action being taken;

-          that any previous advice has not been ignored;

-          that the authorised or an authorised person has not acted deliberately or negligently; and

-          that there has not been a similar previous alleged offence or breach committed by the same authorised…person.”

32.           As regards letters of warning, paragraph 3.2 of the policy stated:

“3.2.1 [CMR] may use a letter of warning to reinforce informal advice or as an alternative to informal advice in a situation where a business is believed to have breached their conditions of authorisation or a breach is ongoing.

…

3.2.4 The letter will include a clear explanation of the possible consequences, such as formal enforcement action, of a failure to take remedial action.”

33.           Paragraph 4.2 of the policy stated that where an authorised person is believed to be in breach of their conditions of authorisation, and the severity of the suspected breaches would make it appropriate to do so, CMR may consider taking formal enforcement action, without first using informal enforcement tools.

34.           In December 2014 CPR published its Financial Penalties Scheme Guidance which set out its approach to assessing financial penalties. In essence, CMR followed a three stage approach as follows.

35.           First, the nature of a breach or collection of breaches was initially assessed under three general levels, each carrying a score as follows:

Basic – Score 1

The breaches are likely to be relatively minor and may also relate to more basic administrative failings. Breaches are not likely to be linked to any significant systemic failures, a business is likely to have cooperated fully with the investigation and may have taken significant steps to remedy the issues raised.

Escalated – Score 2

The breaches are likely to be more serious with a number of factors causing increased concern. It is likely that the authorised person would not have taken on board any previous compliance advice and warnings. There may have been less cooperation with the investigation from the authorised person generally.

Severe – Score 3

The breaches will be the most concerning with a number of factors causing significant regulatory issues. Breaches that fall into this category are generally likely to be deemed as intentional, reckless and negligent. It is likely that the authorised person would have ignored previous compliance advice or warnings and there may have been no cooperation with the investigation from the authorised person.

36.           Second, the overall seriousness of a breach or collection of breaches will be assessed. The level of seriousness is effectively based on the overall impact of the breaches identified and how far the non-compliance has affected other parties.

Low – Score 2

The breaches will be the least serious and are unlikely to have any wide impact on consumers or other organisations. A business placed in this category is likely to be in a position where a clear breach of the rules has been identified but are likely to be administrative or technical breaches which do not have a wide impact.

Medium – Score 4

Breaches that fall into this category are likely to have affected a number of consumers or other organisations. The detriment caused may have affected a group of consumers or limited numbers of other organisations however there is likely to be potential for even further, more widespread detriment if action is not taken.

High – Score 6

Breaches that fall into this category are likely to have already affected large numbers of consumers or other organisations over a considerable period of time. The detriment caused is likely to be widespread and consumers or defendant businesses may have incurred significant costs as result of the business’ practices.

37.           Finally, the scores attributed from the nature and seriousness categories are then added together to give a final score. An assessment of the business’ means will then be conducted and, in conjunction with a final score derived from the initial nature and seriousness assessment, will provide an indication of an appropriate penalty range.

38.           Businesses turning over less than £500,000 per annum were subject to a penalty of no more than £100,000. Businesses with a turnover of £500,000 or more per annum were subject to penalties based on a percentage of their turnover which ultimately cannot exceed more than 20% of their turnover.

Appeals

39.           Section 13(1)(f) CA 2006 provided for appeals to the Tribunal where CMR imposes a financial penalty.

40.           Section 13(3) CA 2006 provided:

“On a reference or appeal under this section the Tribunal–

(a) may take any decision on an application for authorisation that the Regulator

could have taken;

(b) may impose or remove conditions on a person's authorisation;

(c) may suspend a person's authorisation;

(d) may cancel a person's authorisation;

(da) may require a person to pay a penalty (which may be of a different amount from that of any penalty imposed by the Regulator);

(db) may vary any date by which a penalty, or any part of a penalty, is required to be paid;

(e) may remit a matter to the Regulator;

(f) may not award costs.”

41.           It is therefore clear that the Tribunal has a full merits jurisdiction. It was common ground that as a consequence, in exercising its jurisdiction under CA 2006, the Tribunal undertakes a merits review and proceeds by way of a re-hearing in the sense identified by the Court of Appeal in ST Dupont v EL du Pont de Nemours & Co [2006] 1 WLR 2793. It considers all matters afresh and reaches its own decision: in this case as to whether H & H has breached any conditions of its authorisation and, if so, whether it would be appropriate to impose a financial penalty and, if so of what amount.

42.           It was also common ground that the Decision can be set aside for error, but the Tribunal is not concerned with criticising or approving the process by which the Decision was taken. Neither is the Tribunal constrained by the actions of CMR, though given that CMR is the relevant regulator, its views should be given appropriate weight: see R (Hope and Glory Public House Ltd) v City of Westminster Magistrates’ Court [2011] EWCA Civ 31.

43.           As is well established in appeals of this kind, the standard of proof to be applied by the Tribunal is the balance of probabilities, with the burden falling on H & H, as the party seeking to disturb the status quo.

Evidence

44.           We had a witness statement from Mr Gregory Williams, a Technical Specialist in the Authority’s department responsible for the regulation of claims management companies. Prior to the transfer of responsibility for the regulation of claims management companies from CMR to the Authority, Mr Williams was Head of Operations for CMR’s team in Staffordshire and was responsible for the work carried out by CMR’s enforcement teams.

45.           Mr Williams’s evidence covered H & H’s interaction with CMR both before and after the commencement of the investigation undertaken by CMR into H & H and the findings of that investigation. The staff who undertook the investigation reported indirectly to Mr Williams and Mr Williams was involved in the strategic decisions taken during the course of the investigation.

46.           Mr Williams was cross-examined by Mr Stirland. We found Mr Williams to be a knowledgeable and honest witness who, as Mr West submitted, made appropriate concessions and indicated the limits of his knowledge where that was appropriate. We have therefore accepted his evidence.

47.           We also had a witness statement from Mr Urfan Bhatti, the sole director and 50% shareholder of H & H. Mr Bhatti’s evidence dealt with H & H’s dealings with the various entities from which it obtained data and H & H’s dealings with CMR both before and during the investigation. Mr Bhatti also gave evidence regarding the allegations of the use of copied client signatures.

48.           Mr Bhatti was cross-examined by Mr West. We found Mr Bhatti to be a truthful and at times candid witness. Where we have not accepted his evidence, it is not because of any concerns as to Mr Bhatti’s truthfulness or his belief as to the relevant events, but because we have found his explanations either to have been unsupported by the evidence or to be contradicted by other evidence on which we have relied.

49.           In addition, we had a bundle of documents generated during the course of CMR’s investigation.

Findings of Fact

50.           From the evidence that we heard, and the bundle of documents supplied to us, we make the following findings of fact.

Conduct of H & H’s business prior to the investigation

51.           H&H was incorporated on 17 November 2011. It was authorised to provide claim management services on 12 April 2012 and trades from its business premises in Manchester. H & H is owned jointly by Mr Bhatti and Mr Musfequr Choudhury who each hold a 50% shareholding. As mentioned above, Mr Bhatti is the sole director.

52.           H & H specialised in recovering financial compensation for mis-sold Payment Protection Insurance (“PPI”). For a fee, H & H assisted clients to pursue compensation claims against financial institutions for mis-sold PPI. H & H has been profitable but has made a loss in the past year.

53.           H & H has been audited by CMR on visits taking place on 29 May 2014 (the “2014 Audit”) 25 January 2015 (the “2015 Audit”) and 10 March 2016 (the “2016 Audit”).

54.           Mr Williams and another employee of CMR undertook the 2014 Audit and an Audit Report was issued on 17 June 2014, addressed to Mr Bhatti at H & H. The Audit Report described how H & H’s clients were acquired at that time. The report said that H & H acquired clients primarily via its SMS marketing campaign which is carried out by a number of other businesses. These businesses seek out potential claimants by sending SMS marketing messages or conducting telephone surveys. When an individual responds positively to an SMS or telephone survey the details were referred to H & H in return for a fee. Referred details were uploaded a few hours after receipt on to H & H’s auto-dialler for its sales agents to contact the potential claimants. Mr Bhatti accepted in cross examination that this was an accurate description of H & H’s business at the time and we so find.

55.           At paragraph 3.1 of the report CMR stated that when buying leads from authorised businesses, H & H had to comply with the legislation governing the transmission of SMS marketing. H&H’s attention was drawn to Regulation 22 (2) of PECR (as set out at [19] above). The report explained to H & H its obligation to conduct due diligence when purchasing marketing leads resulting from text messages, stating that H & H was required to undertake “thorough due diligence” before purchasing leads to ensure that such leads had been generated in compliance with PECR. H & H’s attention was drawn to the ICO’s 2013 guidance in that regard. The report asked H & H to put measures in place to ensure that leads purchased by the business were compliant with the relevant legislation. The report stated that due to the seriousness of the matter, CMR felt it necessary to warn H & H about the conduct of its business and that it must ensure that its business or any business it instructs had sufficient consent to send SMS marketing to individual members of the public.

56.           Mr Bhatti accepted in cross examination that on the basis of that report, he was not in any doubt as to what the expectations and obligations were on H & H. He confirmed that he reviewed the ICO’s 2013 guidance and accepted that the guidance did not permit a business to rely upon the provider of data to check that consent had been obtained or that he could put the responsibility on to somebody else, including CMR.

57.           Following the 2015 Audit, a copy of the audit report was sent to Mr Bhatti on 22 May 2015. The report recorded that H & H now used one data supplier Road Accident Consult Ltd, trading as Media Tactics (“RACL”). The report said that RACL sent out text messages early in the morning and any responses were sent to H & H hourly with H&H then contacting the responders as soon as possible.

58.            The report noted that H & H had conducted due diligence on its data supplier only in July 2014 when purchasing leads and none after. The report advised that regular due diligence must be conducted, noting that this was important because the data was being generated and received on a regular basis and may originate from various different sources via RACL. The audit report gave H&H guidance on its legal obligations, recommending that H & H check a sample of any data before buying leads so as to check the origin and accuracy of the data. The report also emphasised that H & H should check when and how consent was obtained and what it stated, informing H&H that it may wish to see any privacy policies, including how the client was able to opt out or in and also consider how recently consent was obtained. The report warned H&H that it should not rely on assurances as to compliance with PECR that might be offered by data suppliers.

59.           As an action point, the report stated that H & H should create a regular due diligence procedure and provide CMR with a copy, possibly in the form of a “checklist” or fixed set of questions and thereafter provide an example of due diligence undertaken in line with the created procedure. The report also advised that all due diligence checks should be documented in order to evidence compliance with the Rules.

60.           Mr Bhatti accepted in cross examination that it was clear from the report that there were still serious shortcomings with H & H’s due diligence and that H&H were told to conduct due diligence on privacy policies.

61.           On 22 March 2016, following the carrying out of the 2016 Audit but prior to the issue of the Audit Report, CMR sent H&H a letter (the “Warning Letter”) warning H&H that its conduct was in breach of the Rules and that the matters set out in the letter required its immediate attention.

62.           The Warning Letter referred to the fact that H & H purchased data from RACL and Conico Group Limited. The letter recorded H & H’s confirmation that it conducted checks to assess whether those businesses were registered with the ICO and whether they were authorised by CMR but that at the audit H & H was unable to provide any evidence to show that those checks had been carried out. The letter also recorded H & H’s confirmation that it checked that the data purchased had been generated compliantly by requesting evidence of a sample of opt-ins periodically but stated CMR’s view that the due diligence being conducted was not sufficient as H & H had not requested evidence of a proportional number of opt-ins in comparison to the amount of data purchased. The letter recorded that H & H confirmed that it requested evidence of 3 opt-ins every 4 months from RACL and evidence of 3 opt-ins every month from Conico Group Ltd.

63.           The letter stated that CMR had reviewed the evidence H & H provided as to opt-ins and identified that RACL did not have sufficient consent to send SMS messages to some of the consumers whose data was later purchased because those consumers originally opted-in on www.quotemy.co.uk over 6 months prior to the SMS message being sent and therefore the consent was no longer valid. The letter also recorded H & H’s confirmation that it had not checked the privacy policy or terms and conditions of that website which generated the data which RACL used to send SMS messages to and therefore H & H did not know whether RACL had sufficient consent to send SMS messages to consumers. The letter also recorded that CMR had identified that Conico Group Ltd did not have sufficient consent to make automated calls using the data which had been generated using www.mediaminded.co.uk as that website’s privacy policy did not make consumers aware that they would be contacted by Conico Group Ltd or in regard to PPI claims.

64.           Consequently, the Warning Letter then set out CMR’s contention that H&H had breached the conditions of its authorisation in a number of respects.

65.           First, because H & H was unable to provide evidence of the checks made to assess whether RACL and Conico Group Ltd were registered with the ICO and were authorised by CMR it was in breach of GR 2 (d) of the Rules because it was required to maintain appropriate records and audit trails.

66.            Secondly, CMR said that H & H had not conducted sufficient due diligence on the data purchased from RACL and Conico Group Ltd, advising H & H that each time it purchased data from a data provider it requests evidence of opt-ins which is proportionate to the amount of data purchased.

67.           Thirdly, although H & H had consent to make marketing calls to the data which had been generated by Conico Group Ltd, because Conico Group Ltd did not have sufficient consent to make automated marketing calls to this data, the data used had not been obtained in accordance with the requirements of the legislation and rules. CMR contended that this was the case because www.mediaminded.co.uk’s privacy policy did not make consumers aware that they were consenting to receiving marketing communications from Conico Group Ltd or in relation to PPI claims.

68.           Fourthly, CMR identified that RACL did not have sufficient consent to send SMS messages to some of the data they purchased from www.quotemy.co.uk as the consumers had opted-in over 6 months prior to the SMS message being sent.

69.           Finally, CMR contended that H & H had not checked www.mediaminded.co.uk’s  privacy policy and therefore did not know whether RACL had sufficient consent to send SMS messages to consumers, or whether the data purchased from that entity had been obtained in accordance with the requirements of the legislation and rules.

70.           In relation to the matters detailed at [60] to [63] above CMR contended that H &H was in breach of GR 2 (e) of the Rules.

71.           The Warning Letter concluded by setting out the remedial action that CMR required as follows:      

“-You must cease using the data you have purchased from Conico Group Ltd, as this data has not been obtained in accordance with the legislation and rules.

-You must request that Road Accident Consult Ltd provide you with the information that was purchased on either www.quotemy.co.uk’s privacy policy or terms and conditions. This information should make consumers aware that they would either be receiving marketing communications from Road Accident Consult Ltd or in relation to payment protection insurance claims. Once Road Accident Consult Ltd have supplied this information to you, please provide it to us to review.

-In the future when you purchase data, you must ensure that you review the information which has been provided to the person consenting to ensure that both you and your data providers have sufficient consent to use the data. If you find that either you or your data provider does not have sufficient consent to use the data we do not expect you to use the data.

-In light of the advice we have given in this letter you must update your current due diligence procedures. Once you have updated your procedures please provide the details of your new procedures to us to review.”

72.           The Warning Letter concluded by stating that if H & H failed to act upon this warning and demonstrate that it had taken remedial action and that it was able to comply with the Rules, then CMR was likely to commence an investigation in order to determine whether further enforcement action is required, which was stated to be likely to be statutory enforcement action, including a financial penalty and/or the variation, suspension or cancellation of H&H’s authorisation.

73.           On 1 April 2016 Mr Bhatti replied to the Warning Letter, stating that he had already maintained all records of due diligence and will continue to do so. He said he would now be submitting a due diligence request every week for 0.5% of data purchased, had ceased using data from Conico before the audit visit, had requested from RACL the information published on www.quotemy.co.uk’s privacy policy and will review the information provided to the person consenting to use the data. He also sent the last 2 weeks due diligence request made to RACL, which he said was the only company H&H was purchasing data from.

74.           On 8 April 2016 CMR requested evidence of the due diligence conducted.

75.           On 4 May 2016 Mr Bhatti emailed to CMR the privacy policy which he had obtained for www.quotemy.co.uk. He also supplied spreadsheets further identifying the consent relied on for the text messages that had been sent to consumers. The text of those messages was:

 “Unsure if you qualify for a refund of PPI paid on a loan or credit card? Reply POST for a no obligation check or reply STOP to opt-out.”

76.           Mr Bhatti accepted in cross examination that he did not look at the www.quotemy.co.uk. website privacy policy before H & H used the data provided by RACL.

77.           The privacy policy set out how consumers’ data could be used when they entered it through the www.quotemy.co.uk website. Mr Bhatti accepted in cross examination that this policy did not name RACL or notify consumers that they would receive text messages concerning PPI redress claims and that there was no evidence of the due diligence that was conducted on the website.

78.           On 25 May 2016 CMR wrote to Mr Bhatti stating that H & H had acquired marketing leads generated in breach of Regulation 22 of PECR and had breached its due diligence obligation under GR 2 (e) because it had failed to request and check the www.quotemy.co.uk privacy policy (subject which consumers had supplied their data) before purchasing leads.

79.           The letter then stated that H & H must cease using the data it had purchased from RACL which had been generated using the www.quotemy.co.uk and associated websites. The letter went on to say:

“If you wish to purchase the data of consumers who have responded positively to SMS messages, you must ensure that the organisation who is sending the SMS messages has sufficient consent to do so. In order for consent to be sufficient, when the consumer opted-in they must have been made aware that they were either consenting to receiving marketing communications from that specific organisation, or that they were consenting to receiving marketing communications in relation to miss sold payment protection insurance claims…”

80.           CMR also required H & H, when purchasing its next batch of data, to confirm where that data was generated and provide CMR with evidence of the due diligence conducted on the data to ensure that the data had been obtained in accordance with the requirements of the legislation and the Rules.

81.           On 20 June 2016, Mr Bhatti replied stating that he had just purchased further data from RACL. He went on to say:

“I do not buy data from anywhere else as this was the company that was recommended by yourselves… after our first audit.”

82.           Mr Bhatti also said that he will not be buying data again unless the provider can “substantially prove to me it is compliant.”

83.           In his evidence, Mr Williams disputed that CMR recommended that H & H purchase data from RACL. He stated that as a matter of policy, CMR never recommended particular data suppliers to claims management companies. Mr Williams was personally present at CMR’s first audit visit and was confident that CMR did not recommend any data supplier to H & H.

84.           Mr Bhatti accepted in cross examination that there was no evidence that CMR had recommended the use of any particular firm after the first audit, but he had used that term meaning to refer to CMR’s advice after that audit that H & H should only use a company which was regulated by CMR to carry out marketing.

85.           As regards the statement set out at [82] above, Mr Bhatti confirmed in cross examination that the onus was put on RACL only to send texts to customers which were consistent with the relevant privacy policies and if  RACL were to confirm that the data it was supplying H & H was compliant H & H would use the data and then carry out due diligence as soon as he could after the event to find out if the privacy policies allow the data to be used.

86.           In an email dated 22 June 2016 CMR again stated that the data purchased from RACL had been generated in breach of PECR. CMR reiterated its request that when H & H purchased further data, it should send evidence of the due diligence conducted before buying the data.

87.           Mr Bhatti responded on the same day informing CMR that H & H would not be buying any data “for the next few weeks until I find something you are happy with.” Mr Bhatti went on to ask “what checks do I need to carry out on survey data?”

88.           Mr Bhatti accepted that in light of the previous advice given by CMR, it was surprising that he was now asking CMR to ask about what checks should be carried out, but that he had built up a good relationship with CMR and felt he would be reassured if he had support from CMR in terms of what he was doing.

89.           In an email sent on 24 June 2016 CMR informed Mr Bhatti that if RACL were conducting telephone surveys, then H & H had to check that the consumers concerned had consented to receive RACL’s survey call. CMR went on to provide further guidance, but also observed that it had previously issued H & H with comprehensive advice in relation to due diligence checks it should undertake and recommended that Mr Bhatti review the guidance previously given.

90.           On the same day Mr Bhatti had provided due diligence material regarding the data purchased from RACL in the form of a spreadsheet identifying the websites from which consumers’ mobile telephone numbers had been obtained, but no other evidence of due diligence, such as the websites’ privacy policies or any evidence as to whether the telephone numbers which H & H had been buying had been generated with sufficient customer consent.

91.           On 29 June 2016 Mr Bhatti sent a further email to CMR setting out details of four websites from which data H & H was proposing to purchase was derived and asking whether H & H can “purchase the data followed by due diligence requests”. H & H did not provide any evidence that it had itself reviewed the privacy policies of these websites. In cross examination, Mr Bhatti said he remembered looking at the websites but could not remember whether he was content with the privacy policies, but accepted that he would not have sent the email to CMR if he did not have some concerns. We find that it is more likely than not that Mr Bhatti did look at the websites but was unable to satisfy himself that they were compliant, so sought to obtain confirmation to that effect from CMR.

92.           On 30 June 2016 CMR provided specific feedback on each website mentioned in Mr Bhatti’s email. CMR raised no objections to three of the websites being used to generate leads for H & H. As regards the fourth website, www.swooosh.co.uk, CMR stated that  RACL did not have sufficient consent to send SMS messages relating to mis-sold payment protection insurance to data which had been generated using that website and warned H & H that if it were to purchase data of the consumers who had responded positively to those SMS messages and conduct telemarketing it would be in breach of GR 2 (e) of the Rules.

93.           On 5 July 2016 Mr Bhatti forwarded CMR’s email of 30 June 2016 to RACL with a covering email which stated that CMR had “allowed” three of the websites (which he named in his email) “and no others”. In his evidence, Mr Bhatti said that he regarded the effect of this email as being an instruction to RACL not to use any other websites other than the three to which CMR had raised no objection, suggesting that there would have been other emails and phone calls in which that had been made clear. There was no evidence of any of those other communications before us, so we have to find that the email 5 July 2016 is the only evidence of what RACL were told in terms of the websites that could be used. In our view, that email in itself is not a clear enough instruction for RACL to assume that it should only source data from the three named websites.

94.           Following its review of the information supplied by Mr Bhatti on 24 June 2016, CMR wrote to H & H  on 2 August 2016 stating that in relation to the websites identified by Mr Bhatti in the spreadsheets that he sent to CMR on 24 June 2016 and which were used by  RACL as the source of consumer data used to generate leads for H & H, either the website privacy policies did not evidence sufficient consent or the websites were not live and so CMR had been unable to check what, if any, consent consumers gave. CMR also asked H & H to confirm whether it had purchased data which had been generated using the four websites referred to in Mr Bhatti’s email of 29 June 2016 including www.swooosh.co.uk. and to supply evidence of the due diligence which it had carried out on that data.

95.           Mr Bhatti immediately terminated the contract with RACL as they were causing difficulties with CMR in terms of the data being purchased. H & H then started to use a new supplier, UK Claims Surgery. H & H entered into a signed agreement with UK Claims Surgery which contained a warranty that any data subject whose data is used or supplied to H & H had consented to receive SMS communications from third parties and had permitted the sharing of their personal information with such third parties, although Mr Bhatti said he would not rely on that warranty to satisfy himself that consent being given, but on the relevant privacy policies being complied with.

96.            An email exchange between Mr Bhatti and Key Lead Solutions on 11 August 2016, who described themselves as working with UK Claims Surgery, indicates that three websites would be used to generate leads, although on 12 August 2016 Mr Bhatti informed CMR that leads would be generated from only two named websites where the customers had opted in to receive SMS marketing within the last 6 months. Mr Bhatti confirmed that he had checked the privacy policies which stated that customers may receive SMS marketing in relation to PPI claims. Mr Bhatti’s email concluded with a statement that once he had received the first batch of data, he would send UK Claims Surgery a full due diligence audit request. Although Mr West sought to make something of the fact that UK Claims Surgery had confirmed that it would be using three websites, but Mr Bhatti told CMR that only two of those three websites would be used; we think the discrepancy can be explained by the fact that the third website was one of those which CMR had informed H & H in its email of 2 August 2016 was non-compliant. Although there was no further documentary evidence to this effect, we infer that H & H had decided that the third website should not be used, having checked, as Mr Bhatti said he had, the privacy policies of the three websites. However, it would appear that UK Claims Surgery were not informed by Mr Bhatti of that decision, because, as we find later, data originating from the third non-compliant website was used by H & H.

97.           Therefore, there is no evidence to support Mr Bhatti’s statement that there was a clear agreement between H & H and UK Claims Surgery that only the two websites named in his email of 12 August 2016 to CMR would be used to generate leads. At best the evidence shows that Mr Bhatti simply asked UK Claims Surgery which websites it would use and received a response detailing three websites where the data had been opted in within the last 6 months. There is no evidence of an explicit instruction from Mr Bhatti to UK Claims Surgery that it must use data only from the two compliant websites mentioned in his email of 12 August 2016 to CMR and no other website.

98.           The last sentence of Mr Bhatti’s email of 12 August 2016 to CMR also demonstrates that H & H was purchasing leads generated from UK Claims Surgery before H & H had completed full due diligence as to the consent given by consumers to receipt of the text messages, although Mr Bhatti confirmed that at that stage H & H had undertaken due diligence of the privacy policies of the websites.

99.           On 13 September 2016 Mr Bhatti sent to CMR evidence of the due diligence which had been conducted in the form of a spreadsheet into which the URLs of the websites from which consumers’ details have been obtained by UK Claims Surgery had been inserted. The spreadsheet indicated that UK Claims Surgery had sent SMS text messages to consumers’ mobile telephones in reliance on the privacy or data use policies of these websites. The websites concerned were not limited to the two named websites  referred to at [96] above but also  included www.swooosh.co.uk and another website www.freestuff.eu . As referred to above, CMR had previously indicated that leads generated from the www.swooosh.co.uk website would not have given sufficient consent to receiving texts regarding PPI mis-selling claims. CMR obtained a copy of the privacy policy for the www.freestuff.eu website which mentioned a range of advertising subject-matter and a range of advertisers but did not mention UK Claims Surgery or H & H by name, and did not mention PPI redress claims.

100.        Mr Bhatti’s evidence was that he was disappointed that the two additional websites had been used because he had expected that UK Claims Surgery would only use the two compliant websites, although in cross examination Mr Bhatti accepted that there was no agreement to that effect, even though were was an expectation on his part as a result of conversations he had had with UK Claims Surgery. As we have stated above, we find that there was no explicit instruction from Mr Bhatti to UK Claims Surgery only to obtain data from the two named compliant websites.

101.        Mr Bhatti accepted that although due diligence was subsequently undertaken on www.freestuff.eu it was undertaken after the data had already been used.

102.        On 30 September 2016 CMR wrote to H & H stating that the due diligence evidence provided on 13 September 2016 gave rise to concerns that the due diligence that H & H had conducted was not sufficient. H & H was notified that a formal investigation had now been commenced pursuant to Regulation 35 of the 2006 Regulations.

Events after the commencement of the Investigation

103.        On 30 September 2016 in response to the notice of the commencement of the investigation, Mr Bhatti expressed confusion as to why the investigation and commenced because he said he had “followed every instruction you have requested and guided me step-by-step.” He went on to say that he had conducted due diligence requests on 0.5% of the data received.

104.        On 3 October 2016 CMR responded to Mr Bhatti stating that although due diligence had been conducted on the data purchased from UK Claims Surgery, CMR was concerned that some of the data purchased and subsequently used had been generated in breach of Regulation 22 of PECR and therefore H & H may have breached GR 2 (e) of the Rules.

105.        In response to a request for information from CMR, on 10 October 2016 H & H informed CMR by email that it purchased 19,200 records of data from UK Claims Surgery since 15 August 2016. On 28 October 2016 H & H informed CMR that 17% of its data had been generated from www.swooosh.co.uk and 11% from www.freestuff.eu. and 24% from www.activeyou.co.uk, which was the non-compliant website which UK Claims Surgery had indicated would be used in its email of 11 August 2016 referred to at [96] above. It appears from this email that UK Claims Surgery had used in total seven websites to generate data and not just the three referred to in its email of 11 August 2016.

106.        H & H attached to its email of 28 October 2016 a due diligence report in respect of data acquired in the previous month. Mr Bhatti stated in the email that he had checked all the privacy policies on the opt in websites and they all stated that the consumers may receive SMS marketing in relation to PPI claims and had all opted in within the last 6 months.

107.        CMR gathered no further information regarding H & H’s use of data before completing its investigation. It did, however, seek information from H & H as to its turnover and while considering that information, it was contacted by two financial services firms who expressed concern that H & H had sent them documentation on which signatures had been copied.

108.        In the light of those concerns, CMR carried out a further audit of H & H on 15 March 2017 (“the 2017 Audit”). During the 2017 Audit, CMR identified concerns with signatures in half of a sample of 16 client files which it reviewed.

109.        CMR extended the scope of its investigation to cover this issue. It transpired that an employee of H & H, Ms B, had been copying signatures of clients contained on one document and pasting them on to another document which had not been signed. In particular, signatures were pasted on to letters of authority sent to financial institutions with whom the customer had lending and credit arrangements which gave H & H authority to deal with the financial institution concerned on the customer’s behalf.

110.        H & H admitted that Ms B, who was one of its two administration agents, had copied customer’s signatures on letters of authority without the consent of the customers concerned. It appears that what had happened is that the customer had signed a generic letter of authority that did in fact authorise H & H to act on his behalf in relation to all the accounts that he had with a particular financial institution, but Ms B thought that it was necessary that a separate authority be signed in respect of each account and accordingly had copied the signature on two separate letters of authority for those additional accounts. H & H accepted that this should not have happened and when it was brought to its attention by CMR it addressed the issue immediately and a disciplinary meeting was held with Ms B.

111.        Ms B explained during the disciplinary meeting that she felt under pressure to complete work and therefore had been photocopying the signatures. She accepted that she knew that this conduct was wrong and apologised for her actions. The outcome of the disciplinary meeting was that Ms B was given a final written warning for her conduct and it was agreed that she would receive further training.

112.        Mr Bhatti accepted in his cross examination that although it was not possible to quantify the exact number, that a significant number of letters of authority would have been sent to financial institutions containing a customer’s signature that had been copied in this way.

113.        Although he did not deal with this in his witness statement, Mr Bhatti gave evidence during his cross examination as to the controls that were in place over the manner in which Ms B worked. Mr Bhatti explained that there was an administration manager who supervised the two administration agents. There was no evidence that the other administration agent had been involved in this practice, and Mr Bhatti had no idea why Ms B had adopted this practice. Mr Bhatti said that Ms B would have undertaken training for a period of a week before she joined the department dealing with letters of authority, some three months before the copying incidents took place. Mr Bhatti did not believe that the training would have dealt specifically with the copying and pasting of signatures. He was also unable to explain what steps Ms B’s manager would have taken in relation to reviewing Ms B’s work, particularly in the period shortly after she commenced work in the relevant department. In answer to questions from the tribunal, Mr Bhatti said that whilst after the incident with Ms B there was a considerable amount of employee monitoring, he accepted that there was not a lot before the incidents took place. He also said that there would have been formal procedures in place as to how to deal with situations where signature was missing from a document, but was unable to give any further detail.

Formal enforcement action

114.        On 3 November 2017, CMR wrote to H & H and indicated that it was minded to impose a financial penalty upon H & H and to vary its terms of authorisation (the “Minded To Letter”).

115.        The Minded To Letter informed H & H that CMR considered H & H to be in breach of PECR because of a failure to conduct sufficient due diligence upon data it had obtained. The letter also stated that CMR further considered H & H to be in breach of GR 2(a) and CSR 1(a) in relation to the signatures on the letters of authority reviewed during the 2017 Audit.

116.        The proposed changes of authorisation involved imposition of two conditions:

(1)          That H & H must not use data for regulated claims management services which had been generated through electronic mail or automated calls; and

(2)          Must not conduct marketing using electronic mail or automated calls.

117.        The Minded To Letter also indicated that the penalty had been assessed against CMR’s Financial Penalties Guidance on the basis of a Nature Score of 2 (escalated) and a Seriousness score of 4 (medium). On the basis of a penalty percentage of 6.5% and information from H & H including as to its forecast turnover, the proposed amount of the penalty was set at £108,500.

118.        H & H was asked to provide its actual turnover for the period 1 July 2017 to 3 November 2017. It was also invited to make written representations in relation to the proposed financial penalty.

119.        CMR considered H & H’s representations and on 5 March 2019 the CMR took the Decision. The Decision informed the Appellant that the CMR had decided not to impose the proposed changes to the conditions of authorisation. The penalty was to be upheld, but at a reduced percentage of 5%. The penalty imposed, and which is under challenge in this appeal, was £91,000.

120.        The reason that CMR gave as to why it had decided not to impose the proposed changes to the conditions of authorisation was that H & H had improved its due diligence procedures, provided evidence of this and remedied the non-compliance previously identified. That conclusion was arrived at as a result of it having reviewed the due diligence records provided by H & H on 28 October 2016, as referred to at [106] above, from which CMR concluded that H & H had followed the advice CMR provided in its Warning Letter sent on 22 March 2016, as well as the further letter sent on 25 May 2016 in relation to the websites from which the data had been generated.

Grounds of appeal and issues to be determined

121.        H & H’s Notice of Appeal set out seven grounds of appeal which can be summarised as follows:

Ground 1: The proposed penalty is inappropriate and unwarranted as H & H has taken all reasonable steps to comply with its conditions of authorisation and the Rules.

Ground 2: CMR has failed properly to apply the relevant data protection laws, in particular by interpreting the data condition of “consent” too narrowly and excluding reference to sector specific consent, which was common practice and accepted at the material time.

Ground 3: CMR has failed properly to apply the Information Commissioner’s Direct Marketing Guidance.

Ground 4: CMR is incorrect in alleging that H & H had undertaken an insufficient level of due diligence on its lead/data providers.

Ground 5: The forging of signatures was an isolated incident which does not merit a financial penalty.

Ground 6: CMR has failed to follow its own Enforcement Policy in that there were other more appropriate enforcement actions available.

Ground 7: CMR has failed properly to apply its Financial Penalties Guidance in assessing the amount of the financial penalty.

122.        Grounds 1, 2, 3 and 4 in our view deal with different aspects of the central issue in this case which is whether H & H failed to take all reasonable steps to comply with the Rules when dealing with personal data which H&H had acquired from the intermediary companies which it used, namely RACL and UK Claims Surgery. In that context it is necessary to consider whether H & H acted in breach of the relevant data protection laws or failed to follow relevant guidance. We can therefore deal with these grounds together by considering whether overall H & H has acted in breach of GR 2 (e) as a result of the manner in which it has dealt with personal data.

123.        Ground 5 in essence contends that the issue of the copied signatures is not of significance and should not be taken into account in considering whether a financial penalty is appropriate. In our view this ground is closely linked to Ground 6, which asks the Tribunal to consider whether, insofar as there have been breaches of the Rules, a financial penalty is warranted. We can therefore deal with Grounds 5 and 6 together by considering whether overall H&H’s conduct of which CMR complains justifies the imposition of a financial penalty.

124.        Mr Stirland clarified in his submissions that Ground 7 in essence contends that if a financial penalty is justified, it should be calculated on the basis of a nature score of 1 rather than 2 and a seriousness score of 2 rather than 4, resulting in a penalty of £45,500 rather than £91,000.

125.        We shall therefore determine this appeal by considering three issues as follows:

Issue 1: Whether H & H has acted in breach of GR 2 (e) in the manner in which it dealt with personal data.

Issue 2: Whether all or any of H & H’s conduct of which CMR complains justifies the imposition of a financial penalty.

Issue 3: If Issue 2 is determined in favour of CMR the appropriate amount of the financial penalty.

126.        We shall now deal with each of these issues in turn.

Issue 1: Whether H & H has acted in breach of GR 2 (e)

127.        It is helpful to start with a summary of the process by which individuals’ data came to be in the possession of H & H to be used for the purpose of marketing to those individuals H & H’s claims management services in relation to PPI claims. This is derived from the findings of fact that we have made above.

128.        The process starts with an individual visiting a website, such as www.freestuff.eu, and inputting details of their name, telephone number and email address. There will be a privacy policy on the website which indicates who might contact the individual at a later date. The data may be passed on several times to various intermediaries in accordance with the terms of the privacy policy and ultimately the intermediary, such as RACL or UK Claims Surgery in this case, who wishes to sell relevant data to a claims management company, will need to ensure that the privacy policy of the relevant website envisaged that the individual whose data is to be sold had given its consent to be contacted by SMS about claims management services in relation to PPI claims. Assuming the intermediary was so satisfied, it would obtain the individual’s consent to be contacted by a claims management company with a view to providing services in relation to PPI. That consent or opt-in is obtained shortly before the sale of the data by the sending of an SMS by the intermediary to the individual along the lines of the text set out at [75] above. Details of those individuals who have responded positively to such messages are then sold on to the claims management company who will then make a live telephone call to the individual concerned seeking to market its services in relation to PPI redress. In this case, as we have found, as soon as the data was passed on by the intermediary it was loaded on to H & H’s auto-dialler and the phone call was then made by one of H & H’s employees.

129.        We repeat for convenience the relevant requirements of Regulation 22 (2) of PECR which prohibit the use of electronic mail (which includes SMS messages) for direct marketing purposes unless the recipient has consented to being contacted in that way for such purposes:

 “…. a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.”

130.        Therefore, as submitted by Mr West, H & H would be acting unlawfully in using the data which it purchased for the purpose of marketing its services to the individuals in respect of which it had acquired the data if either the intermediary who sold the data to H & H had not obtained a valid opt-in to be contacted about services of the kind that H & H were offering or the privacy policy of the relevant website from which the data was derived did not envisage the individual concerned being contacted by a third party in relation to those services, because in those circumstances the individual would not have consented to being contacted about such services in that manner.

131.        In relation to the requirements of PECR in this case, as they applied to the intermediary from whom H & H acquired its data, in essence Mr Williams adopted in his evidence the formulation set out in CMR’s warning letter of 25 May 2016 as set out at [79] above. That approach also envisaged that before the intermediary sent text messages to the consumer that intermediary would need to be satisfied that the websites from which the data was generated also envisaged the consumer being contacted in that manner with regard to PPI redress claims. As Mr Williams stated in his evidence, that formulation was based on paragraph 79 of the ICO’s 2013 guidance, as set out at [22] above. By way of example, Mr Williams referred in his evidence to the fact that the privacy policies of www.swooosh.co.uk and www.freestuff.eu did not inform consumers that they would receive text messages from UK Claims Surgery or H & H; nor did they mention any “specific category of organisations” into which H & H “clearly falls”. Mr Williams also said that those privacy policies did not mention PPI redress claims. He went on to say that even if the categories mentioned in the privacy policies (that is “financial provider” or entities in the “finance” “sector” providing “… Pensions, loans, credit cards and mortgages,.. Investments & savings”) met the “specific category” requirement identified by ICO, UK Claims Surgery and H & H did not “clearly fall” within these categories. Mr Williams also stated that CMR considered that the two finance-related categories mentioned in the privacy policies were too wide and did not meet the specificity requirement identified by ICO.

132.        With respect to what could be regarded as having taken all reasonable steps to confirm that any data had been obtained in accordance with the requirements of PECR, as required by GR 2(e), in essence CMR’s position on this issue was, as stated by Mr Williams in his evidence, as follows. In Mr Williams’ view, H & H breached GR 2 (e) if it purchased marketing leads without first having exercised due diligence; that is without first having taken all reasonable steps to avoid purchasing leads generated in breach of PECR. In his view, due diligence included, before purchasing or using any leads, taking a sample of leads and determining from which websites data suppliers had obtained consumers’ mobile numbers and checking that the privacy policies of those websites provided sufficient, specific consent.

133.        It is clear from our findings of fact that CMR consistently took that position in the various audit reports and Warning Letters that it issued to H & H.

134.        As it appears from our findings of fact, H & H over the period that is relevant to this appeal, in summary took the following steps in relation to due diligence on the data it purchased:

(1)          There is no evidence that H & H had carried out any due diligence on the data it had purchased prior to the 2014 Audit and CMR’s warning in that report that H & H undertake due diligence before purchasing leads to ensure that such leads had been generated in compliance with PECR: see [55] above.

(2)          Between the issue of the 2014 and 2015 Audit reports, CMR did carry out some due diligence on RACL but only on one occasion in July 2014. There is no evidence of the nature of the due diligence that H & H had undertaken in July 2014: see [58] above.

(3)          Between the issue of the 2015 and 2016 Audit reports, H & H had carried out the following due diligence:

(a)          checks to assess whether its two data suppliers were registered with the ICO and whether they were authorised by CMR, but it was unable to provide any evidence to show that those checks had been carried out: see [62] above; and

(b)         checks that the data purchased had been generated compliantly by requesting evidence of a sample of opt ins, namely evidence of 3 opt ins every 4 months from RACL and evidence of 3 opt-ins every month from its other supplier: see [62] above;

 

H & H had not checked the privacy policies or terms and conditions of the websites which generated the data which its suppliers used to send SMS messages: see [63] and [69] above.

(4)          Following the Warning Letter issued on 22 March 2016 H & H submitted a due diligence request every week to RACL for 0.5% of data purchased: see [73] above.

(5)          In relation to the websites used to generate the data provided by RACL, Mr Bhatti did not look at the website privacy policy before H & H used the data generated from it. Mr Bhatti was unable to provide evidence of the due diligence that was conducted on the website and accepted that the policy did not name RACL or notify consumers that they would receive text messages concerning PPI redress claims: see [76] and [77] above.

(6)          H & H put the onus on RACL only to send texts to customers which were consistent with the relevant privacy policies and H & H used the data if RACL confirmed that the data it was supplying was compliant; H & H carried out due diligence as soon as possible after the event to find out if the privacy policies allowed the data to be used: see [85] above.

(7)          The due diligence that H & H carried out on the data provided by RACL consisted of sending RACL spreadsheets containing the mobile telephone numbers of the consumers whose data had been supplied so that RACL could complete the spreadsheet with details of the websites which had been used to generate the data; it subsequently transpired that the privacy policies of those websites did not evidence sufficient consent or were not live so it was not possible to check what, if any, consent consumers had given: see [90] and [94] above.

(8)          In June 2016 H & H asked CMR for guidance as to what checks it needed to carry out on survey data and asked CMR whether it could purchase data and then carry out due diligence checks on four named websites in respect of which Mr Bhatti had checked the privacy policies, but could not satisfy himself were compliant: see [87] and [91] above.

(9)          Whilst on 5 July 2016 H & H indicated to RACL that three of the named websites which it had asked CMR to check could be used it did not explicitly prohibit RACL from generating leads using other websites: see [93] above.

(10)      H & H started using UK Claims Surgery as its data supplier in August 2016, but there was no clear agreement with UK Claims Surgery that only two websites where the privacy policies were compliant would be used to generate data and a number of websites were used to generate data which had non-compliant privacy policies: see [96],[97] and [99] above.

(11)      H & H purchased leads generated from UK Claims Surgery before it had completed full due diligence as to the consent given by consumers but after it had undertaken due diligence of the privacy policies of the websites: see [98] above.

(12)      Due diligence on the website www.freestuff.eu was undertaken after the data generated by UK Claims Surgery from that website had been used: see [101] above.

(13)      A due diligence report sent to CMR on 28 October 2016 demonstrated that the due diligence carried out on the data referred to in the report had been undertaken satisfactorily and the non-compliance previously identified by CMR had been remedied: see [106] and [120] above.

135.        Mr Stirland’s submissions on Issue 1 can be summarised as follows:

(1)          H & H does not accept that it acted in breach of Regulation 22 (2) of PECR. In particular, the 2013 guidance issued by the ICO in 2013 did not specifically rule out consent being given by consumer in general terms, such as by agreeing to marketing from “selected third parties” whereas the position was tightened up in the 2016 guidance. Mr Stirland also relies on the guidance given by the Direct Marketing Association, a trade body, on 15 May 2014 as regards the ICO 2013 guidance. That guidance (the “DMA guidance”) referred to the position where an individual has given generic consent to a business to receive email or SMS marketing communications from an unspecified third party organisation and stated that such generic consent could not be relied upon unless the party that collected the consent specifically named the third party or the first party had obtained consent from the individual to pass on their details to specific types of organisations (e.g. a travel company) and the third party falls into that category. It would appear that in reliance on this guidance Mr Stirland was submitting that in this case generic consent given by an individual to being contacted by financial institutions would be sufficient to satisfy the requirements of PECR. The DMA guidance also dealt with the position of unlimited third-party consent and stated that such consent could be valid where there was clear wording in a prominent position that made the individual aware that his details would be passed on to third parties. The DMA gave the following as an example:

“By registering and entering your details you consent to receiving promotional offers from [name of organisation collecting the information] and other carefully selected reputable organisations and well-known high street names. You also agree to the terms and conditions of the Privacy Policy (hyperlink) and the Cookie Policy (hyperlink) that govern how your information will be processed.”

Mr Stirland submits that when read together with the ICO’s 2013 guidance the DMA guidance indicates that CMR took too narrow an approach to the question of consent in the advice that it gave to H & H and did not reflect the market practice at the time which placed more reliance on unlimited third-party consent. Mr Stirland observed that Mr Williams when cross-examined did not offer any criticism of the DMA guidance and appeared to adopt a neutral stance in relation to it.

(2)          CMR had adopted the position that a firm should be cautious in proceeding on the basis that a consent was valid when it had been obtained more than 6 months before it was acted upon. In many cases H & H had acted upon consents which were more than 6 months old (some were more than 2 years old) but there was nothing in either PECR or the relevant guidance which indicates a requirement not to act upon a consent which is more 6 months old.

(3)          H & H had taken all reasonable steps to comply with the Rules. The Rules did not contain any definition as to what was meant by “all reasonable steps”. H & H had consistently shown a determination to engage with CMR to try and get things right. They did not always get things right, but the large numbers of email exchanges and questions asked of CMR by H&H demonstrate a real effort to take the reasonable steps required. H & H engaged with the regulator and established a good relationship with CMR such that by October 2016 CMR recognised that improvements in H & H’s approach had occurred.

(4)          H&H’s position was that due diligence on the data purchased should be undertaken after it has been acquired when it is fully available, and that approach appeared reasonable to H&H at the time. It was not practicable to review data before it has been purchased and it was not industry practice to do so. H & H accepts that it was not unreasonable to review websites from which data was generated before the data concerned was purchased. H&H sought guidance from CMR as to whether it was acceptable to use data generated from various websites.

(5)          It was unclear from the guidance that was available when a due diligence check should have been carried out and H & H took a decision that it would approach the issue by seeking to put suppliers on notice of what it was expecting to receive in terms of the quality of the data so as to encourage the supplier to only send data that could be validly used.

(6)          Whilst H & H accepts that the www.freestuff.eu. and www.swooosh.co.uk websites were non-compliant, it is for the tribunal to determine whether or not the other websites used were non-compliant.

(7)          There is no specific rule or guidance as to how large a sample of opt-ins should be. CMR had indicated that H & H’s initial practice of only checking 3 or 4 items from each batch of data was insufficient but declined to give H & H any guidance as to what a reasonable sample would be or whether H & H’s later practice of checking 0.5% of the data received was acceptable.

136.        We reject Mr Stirland’s submission that CMR took too narrow an approach to the question of consent in the advice that it gave H&H regarding the interpretation of Regulation 22 (2) of PECR.

137.        Indeed, in our view both CMR and ICO, the latter in its 2013 and 2016 guidance on which CMR relies, have taken a pragmatic approach to the question of indirect consent. On the face of it there is nothing in the wording of Regulation 22 (2) which indicates that anything other than consent given by the relevant consumer directly to the person who sends the relevant communication will suffice. In all of the instances with which this appeal is concerned, any consent was given to the operator of the relevant website, and not directly to the intermediary who subsequently sent the text message to the consumer asking if the consumer was willing to opt in to being contacted about redress for PPI claims. Therefore, as ICO indicated at paragraph 76 to 79 of the 2013 guidance, as set out at [22] above, it has adopted a purposive approach to the interpretation of the provision but in such a way that the validity of an indirect consent is to be carefully and specifically circumscribed.

138.         Against that background, there is nothing in the legislation to support Mr Stirland’s submission that limiting indirect consent to circumstances where the consent very clearly described precisely defined categories of organisations who may contact the consumer and the precise nature of the services that would be marketed was too narrow.

139.        We therefore conclude that the approach taken by CMR to the interpretation of Regulation 22 (2), as summarised at [131] above, was correct and consistent with the legislation, as interpreted by ICO in its guidance. We do not see any material difference between the 2013 guidance and the 2016 guidance in this regard. The 2016 guidance merely provided further clarification of the position taken by the ICO in 2013 and did not indicate a narrowing of its position.

140.        Neither do we consider that the DMA guidance assists H & H. That guidance was not industry specific and we do not think that the example given of the travel industry can be easily extrapolated so as to conclude that consent to being contacted by financial institutions was sufficient to envisage being contacted by a claims management company about potential PPI claims. Neither could it be said that the example given by the DMA of unlimited third-party consent which referred to “carefully selected reputable organisations and well-known high street names” had the necessary degree of specificity indicated by the example given by CMR and set out at [131] above.

141.        In any event, there is no evidence in this case that H & H ever reviewed the DMA guidance or relied on it to any material extent.

142.        With regard to the position taken by CMR that an indirect consent should not be more than 6 months old, we agree with Mr Stirland that there is nothing in the legislation or the ICO guidance that indicates that a consent may become stale after a particular period of time. However, bearing in mind what we have said about the scope of an indirect consent being carefully circumscribed, it may not be reasonable to rely on a consent that was obtained a long time before it was relied upon. That will be a question of degree depending on the circumstances of the case, but it appears to us that it would not be unreasonable to expect a firm to adopt its own policy as to the point at which a consent became stale and to document its reasons as to why it had adopted the particular time limit that it had.

143.        We therefore conclude that H&H acquired considerable amounts of data generated from websites where the consumer had not given a valid consent to be contacted regarding PPI claims. As a consequence, a considerable number of consumers contacted by the relevant intermediaries from whom H & H acquired the data by SMS messages of the kind set out at [75] above had not given a valid consent to be contacted in that way and consequently the communications concerned had been made in contravention of PECR. H & H did not seek to argue that if CMR’s interpretation of Regulation 22 (2) was correct, nevertheless it was wrong in its assessment of the privacy policies of any of the various websites that it reviewed in the course of its interaction with H & H during the period which is relevant to this appeal.

144.        We turn now to the question of whether H & H had taken all reasonable steps to confirm that the leads or data which it obtained during the period which is relevant to this appeal was obtained in accordance with the requirements of the legislation and the Rules.

145.        We start by observing that GR 2 imposes an overarching obligation on an authorised firm to conduct itself responsibly overall, including acting with professional diligence. GR 2 (e) is merely one of the examples of what an authorised firm must do to meet that overall responsibility. Therefore, if a firm fails to put in place reasonable measures or procedures with a view to ensuring that leads or data have been obtained in accordance with relevant legislation (that is PECR in this case) or, if having adopted a policy which in itself could probably be regarded as constituting reasonable steps but fails to carry out that policy with professional diligence, for example by not carrying out the due diligence steps that its policy indicates that it would, then such a failure would constitute a breach of GR 2.

146.        We have concluded in this case that consistently throughout the period which is relevant to this appeal up to the point at which it appears H & H had remedied its previous failings (that is by 28 October 2016), H & H failed both initially to put in place appropriate due diligence procedures and, after it sought to do so, failed to operate them with professional diligence. Those failings in our view constituted a breach of GR 2 for the following reasons.

147.        The question as to whether an authorised firm has acted with professional diligence or has taken all reasonable steps to comply with relevant legislation is, as was common ground, an objective test. The relevant regulator may, subjectively, come to a view as to whether a firm has met the relevant standard but ultimately it is for the Tribunal to assess, objectively, whether the regulator’s assessment can be upheld. It is well-established that in cases of this kind, where the court or tribunal is asked to decide whether a particular course of action is reasonable, it is necessary to undertake a multifactorial assessment and arrive at a value judgment. This means that we should treat all the relevant circumstances as facts which have to be balanced together to reach an assessment or evaluation in relation to this particular case, using our expertise as a specialist tribunal.

148.        That being the case, it would not be appropriate to be prescriptive about the steps that should be taken in any particular case in order to comply with the relevant standard. It seems to us, however, that a number of different steps can be pursued, in combination with each other which together amount to the taking of all reasonable steps. It appears to us that where the claims management firm has a business model similar to that of H & H such a combination could consist of:

(1)          Asking the data supplier for details of websites from which the data was to be generated and then undertaking a review of the privacy policies of those websites to see whether, in principle, they envisage the data being used for the purpose of marketing the services of a claims management company in relation to PPI redress claims.

(2)          Reviewing the text of the SMS message used by the intermediary to obtain opt-ins from the consumers concerned and satisfying itself that it was consistent with the privacy policies of the websites concerned.

(3)          Reviewing an appropriate sample of the data to be supplied before purchase to satisfy itself that appropriate opt-ins had been obtained.

(4)          Putting a degree of responsibility on the part of the intermediary to provide compliant data by seeking a warranty from the intermediary that all relevant data supplied will be in compliance with the legislation.

(5)          Seeking guidance from the regulator on points of difficulty or where clarification of the regulator’s approach or policy is needed.

149.        All of these steps envisage reasonable steps being taken before any data is purchased from the intermediary concerned. We accept CMR’s contention is that such an approach is necessary because of the manner in which the legislation operates.

150.        As Mr West submitted, the nature of the vice that is being addressed by the requirement to undertake due diligence is to prevent the potential customer who is ultimately approached for claims management services in relation to PPI from being approached unless he has given appropriate and sufficient consent to being contacted in that way. The customer will not expect to be contacted in that way unless he has given sufficient consent for agreeing to an appropriate privacy policy on the website in which he entered his data. That means he should not be contacted by the intermediary by SMS seeking an opt in for claims management services unless the consent  given envisages being contacted in that way and for that service. Likewise, if he has not given consent, then if his data is nevertheless passed on to a claims management company, such as H&H, and the information loaded onto its auto-dialler without being checked then there would have been a breach of the legislation at the time that H&H’s agent contacts the consumer.

151.        Therefore, as Mr West submitted, there is a multi-layered system of regulation and the obligations do not just sit on the first person in the chain; there is an obligation of each person in the chain to ensure that the relevant data is dealt with in accordance with the legislation. Even if it might be said that a person who received a text message in breach of the relevant privacy policy but nevertheless did not specifically opt out of being contacted about PPI suffered no loss, and indeed may get some benefit if it turns out that he does have a valid claim for PPI redress, there could be many thousands of customers who were contacted inappropriately by SMS and at the very least, were inconvenienced. There needs to be an incentive on each of the people in the chain to ensure that the legislation is complied with.

152.        We therefore do not accept that it would be a reasonable step to check a sample of the data after it has been used, that is in this case after it had been loaded onto H & H’s auto-dialler. That is shutting the stable door after the horse has bolted and the mischief against which the legislation is directed would not have been addressed. Whilst discovering through due diligence that data has been used in breach of the legislation might address the problem for the future and prevent the firm acquiring any further non-compliant data, it will not cure the breach that has already occurred. We do not accept, as submitted by Mr Stirland, that it was not practicable to review data before it was purchased or that it was industry practice not to do so. No evidence was adduced before us to make good those submissions. In any event, if an industry practice is not compliant with the law, it does not make it acceptable just because everybody else in the industry is doing it. We cannot see the difficulty in asking for a sample of the data that was to be used in advance of purchase, against an undertaking not to use it until it has been properly reviewed and paid for or having purchased data to confirm that it was compliant before using it to generate calls.

153.        That is not to say that it is necessary to review all data before it is used. The Rules only require “all reasonable steps” to be taken, not all possible steps. Therefore, a process of sampling of data is a reasonable step to take and the question then is whether the sample is large enough to give a reasonable indication of whether substantially all of the data purchased will be compliant.

154.        In this case, it was common ground that a large amount of data was being obtained at each purchase. Therefore, H&H’s former practice of only checking 3 or 4 items at a time is in our view unlikely to give a reliable indication that the data as a whole was likely to be compliant. Mr Williams declined to give any hard and fast guidance on this and clearly it must be a question of what is appropriate in all the circumstances of the case. He did not, however, indicate that H & H’s practice of checking a sample of 0.5% of the data received was too low, in the circumstances of this particular case, and we are therefore prepared to accept that in this case such a sample would be appropriate. However, the difficulty for H&H is that it never checked data before it was used, so however large the sample was, it was never going to be sufficient to give H & H reasonable comfort that the necessary consents for the use of the data had been obtained.

155.        We agree that putting the supplier under a contractual obligation to ensure that all data supplied in accordance with the relevant legislation is a reasonable step to take. That is so both for good commercial reasons, so that the purchaser can ensure that it is in fact obtaining a valuable asset in return for the purchase price, but also as a regulatory matter as it will help to concentrate the mind of the supplier on the question of compliance. However, in our view such an approach cannot be a substitute for the purchaser carrying out its own due diligence before the data is purchased and before it is used. That follows from our conclusion that the responsibility is on each person in the chain to take reasonable steps to ensure that the data is being used compliantly and it is not open to a purchaser of data to seek to shift the responsibility upon the supplier and exclude its own obligation to take reasonable steps to satisfy itself that the data is being obtained compliantly.

156.        As regards seeking guidance from the regulator, again the firm cannot shift the responsibility for establishing that data will be used compliantly on to the regulator. In our view the regulator is under no duty to prescribe to an authorised firm the precise steps that the firm should take to ensure compliance. Neither is the regulator under a duty to review the privacy policies of websites and inform the firm whether or not data generated from those websites and used by the firm to market particular services would have been obtained in a compliant fashion. As we have said, there may be specific points of difficulty on which guidance may be sought. There may be particular provisions in a privacy policy on which it might be appropriate to seek guidance; likewise, in our view it would not be unreasonable for a firm to inform the regulator as to the steps it was going to take as regards sampling and ascertain whether the regulator had any views on the approach. That is not a substitute for the firm itself deciding what is the appropriate approach in the circumstances of its own particular business.

157.        In the light of that discussion we turn now to the particular steps that H & H took in this case as regards due diligence and whether, taken together, they amounted to it having taken all reasonable steps to comply with the relevant legislation.

158.        It is helpful to deal with this question by reference to the factual findings set out at [134] above.

159.        In that respect, it is clear from our findings that H & H carried out no due diligence on the data it purchased prior to the 2014 Audit. There was therefore a clear failure on the part of H & H comply with its relevant obligations prior to that time.

160.        Between the 2014 and 2015 Audit reports, H & H only carried out due diligence on one occasion. There was therefore clear failure on the part of H & H to take all reasonable steps to undertake due diligence in respect of all the data that it acquired. In any event, the due diligence that it did undertake did not amount to the taking of all reasonable steps because it was undertaken after the data had been purchased and used.

161.        Between the 2015 and 2016 Audit reports, the due diligence carried out by H & H was insufficient to constitute the taking of all reasonable steps because:

(1)          It was all carried out after the data had been purchased.

(2)          The sampling of data it carried out was insufficient.

(3)          It had not checked the privacy policies or terms and conditions of the websites which generated the data concerned before the data was purchased.

(4)          It placed undue responsibility on RACL to sell only compliant data and therefore used the data if RACL confirmed that the data supplied was compliant without carrying out its own due diligence in advance of the purchase.

(5)          The practice of asking RACL to complete the spreadsheets sent by H & H with details of the websites which had been used to generate the data was insufficient as a reasonable step because it meant that whether the privacy policies of the websites concerned were sufficient to allow the data to be used could only be checked after the data had been purchased.

(6)          The request made to CMR in June 2016 as to what checks should be carried out was not a reasonable step as it was for H & H to determine that issue itself, in light of the guidance previously given to it in that regard by CMR and the various Audit reports and warning letters.

(7)          Whilst H & H took some steps with a view to ensuring that both RACL and UK Claims Surgery only used websites whose privacy policies had been checked, those steps were inadequate because they did not specifically prohibit the use of other non-compliant websites.

(8)          H & H  purchased leads generated from UK Claims Surgery before it had completed full due diligence as to the consent given by consumers to receipt of the text messages,  albeit that at that stage H & H had undertaken due diligence of the privacy policies of the websites.

(9)          Due diligence on the website www.freestuff.eu was undertaken after the data generated by UK Claims Surgery from that website had been used.

 

162.        Although it appears that by 28 October 2016 H & H had improved its procedures and the non-compliance previously identified by CMR had been remedied, we conclude that H & H had until at least August 2016 frequently carried on its business in breach of GR 2(e) in the manner in which it dealt with personal data. We therefore determine Issue 1 in favour of the Authority.

Issue 2: Whether a financial penalty is justified

163.        Mr Stirland submitted that that even if H & H breached GR 2 (e) no financial penalty was justified in respect of the breaches concerned because:

(1)          H & H sought advice from CMR and complied with that advice at all times so that there was no failure to conduct due diligence that can be described as reckless or negligent.

(2)          CMR did not take into account the failings of third parties, against the clear efforts by H & H to put those third parties on notice of what was required of them.

(3)          H & H had remedied the previous breaches by 28 October 2016 and paragraph 3.1 of CMR’s Enforcement Policy indicates that informal enforcement action should be taken where the firm has remedied the situation before formal action was taken.

 

164.        With respect to the issue regarding the copying of signatures by Ms B, Mr Stirland did not dispute that Ms B’s actions had put H & H in breach of GR 2(b) and CSR (1) (a), the text of which is set out at [17] and [18] above. Mr Stirland was right not to do so, because in our view it is self-evident that the act of copying a customer’s signature from one document to another without his consent cannot be regarded as being acceptable conduct in any circumstances.

165.        Mr Stirland does however play down the seriousness of that breach. He accepted that the practice was “abhorrent” and did not reflect the values of the business. He says it was the action of a rogue employee working to her own agenda against a background where she had been given sufficient training in her job. Mr Stirland submits that there was no benefit to H & H; the process carried out by Ms B had been totally unnecessary because one signed letter of authority was sufficient. H&H took immediate steps to deal with the matter when it was brought to its attention, holding a disciplinary hearing and it could not reasonably have been expected to have done anything more. The practice had also only carried on for a limited period.

166.        Accordingly, Mr Stirland submits that the activity of copying of the signatures was neither deliberate, negligent or reckless and should not form part of the equation when considering whether a financial penalty should be imposed, particularly because by the time this particular conduct was investigated the previous problems regarding the non-compliant use of data had been resolved.

167.        We reject those submissions and conclude that a financial penalty is justified, both in respect of the breaches regarding the use of data and the issue with the copying of signatures.

168.        As regards the data breaches, Mr Stirland’s interpretation of CMR’s Enforcement Policy, as summarised at [30] to [33] above, is misconceived. The policy indicates a range of informal action that CMR would take if it identifies a breach of the relevant regulatory provisions. These include advice and letters of warning. Mr Stirland relies on the first bullet point of paragraph 3.1 of the policy, as set out at [31] above, for his submission that informal action should be the outcome in all circumstances where CMR has been satisfied that the authorised person has remedied the situation and because H & H had remedied the situation by 28 October 2016, CMR should not have taken formal enforcement action. However, that submission ignores the rest of paragraph 3.1 which indicates that informal action will not be the appropriate course where any of the following factors apply:

(1)          any previous advice has been ignored;

(2)          the authorised person has acted deliberately or negligently; and

(3)          there has been a similar previous breach committed by the same authorised person.

169.        As our findings of fact show, the decision to take formal enforcement action followed the taking of informal action in the form of the issue of advice and a number of warnings. A warning was issued to H & H following the 2014 audit that its failure to address the question of due diligence was a serious matter and CMR gave H & H advice as to the need to undertake due diligence before purchasing leads. Mr Bhatti accepted in evidence that he was in no doubt as to what the expectations and obligations were on H & H following that warning, but it was clear from the results of the 2015 Audit that the advice was not being followed. Further guidance was given in that report, as described at [58] and [59] above. Mr Bhatti accepted in cross examination that at that time there were still serious shortcomings with H & H’s due diligence. Despite that further advice, a further warning letter was issued following the 2016 Audit because of continuing failings which were identified and, as set out at [72] above, H & H was warned that formal enforcement action could occur if H & H failed to act upon the latest warning.

170.        The fact that H & H was repeatedly unable to remedy the situation despite the advice and warnings that were given demonstrates that H & H failed to act with the required degree of competence and therefore acted negligently. H & H was given clear advice as to the remedial steps that should be taken, as Mr Bhatti acknowledged. H & H however, failed to take the necessary action to implement the necessary remedial measures. Neither do we consider that CMR was wrong not to give greater weight to the efforts that H & H took to make sure that the intermediaries it used were aware of their responsibilities. As we have previously indicated, the prime responsibility to undertake due diligence remains with H & H alone.

171.        In those circumstances, it was clear that the informal action had not had the desired effect of causing H & H to remedy the situation.  Therefore, in our view CMR was fully justified in opening an investigation when further failings came to light in September 2016 and ultimately deciding to take enforcement action by seeking a financial penalty. The fact that H & H did ultimately remedy the situation is of no consequence in circumstances where previous informal action has not had the desired effect. It is absolutely clear from the policy that in those situations, formal enforcement action is likely to follow if the failings continue, as it inevitably did in this case.

172.        As regards the copying of signatures, we do regard this as a serious matter. The integrity of the financial system depends upon financial institutions being able to rely upon the genuineness of the documents that they are asked to act upon. The fact that in this particular case there was no benefit to H & H or detriment to the financial institutions concerned is of no significance. H & H was unable to produce any evidence as to what training of staff took place which would have made it absolutely clear that the practice of copying signatures was unacceptable. Neither is there any evidence of what supervision of Ms B actually took place in practice and the extent to which, if any, her work was checked and how those checks were undertaken. It seems to us inconceivable that the problem would not have been picked up earlier had there been some checks on how Ms B was dealing with letters of authority. The burden was on H & H to provide evidence of these matters and none was forthcoming. The matter was only addressed through the convening of a disciplinary meeting when CMR brought the issue to H & H’s attention. In those circumstances, the only reasonable inference we can draw is that there was no proper training or supervision of Ms B in relation to these matters.

173.        We must therefore conclude that H & H did act negligently in failing to provide proper training and supervision of Ms B and the underlying matter was so serious that a financial penalty is justified.

174.        We therefore determine Issue 2 in favour of the Authority.

Issue 3: the appropriate amount of the financial penalty

175.        Mr Stirland submits that were the Tribunal to consider that a financial penalty was justified, it should be no more than £45,500, that is 50% of the penalty determined by CMR.

176.        Mr Stirland submits that the breaches concerned were basic administrative or technical failings not linked to any significant systemic failures, H & H cooperated fully with the investigation and significant steps were taken to remedy the issues raised. Mr Stirland submits that the breaches were not serious and have no wide impact on consumers or other organisations. On that basis, he submits that CMR should have regarded the nature of the breaches as basic, and the seriousness of the breaches as low.

177.        We reject those submissions. In our view, the data breaches were serious and followed from H & H not having taken on board previous compliance advice and warnings. For the reasons we have given above, we regard the issue regarding the copying of signatures as being serious as well. The detriment caused had the potential to affect a considerable number of consumers and the fact that there were no actual complaints from consumers is not relevant. In those circumstances, CMR was correct in regarding the nature of the breaches being escalated, and the seriousness as medium, according to CMR’s guidance, as set out at [35] to [36] above.

178.        There is no suggestion that the application of CMR’s guidance has given rise to a disproportionate or unjust result in this case as regards the amount of the penalty. Neither have CMR’s calculations been challenged. In those circumstances, we see no reason to interfere with CMR’s decision as to the amount of the financial penalty in this case. We received no submissions as to whether we should vary the date by which the penalty is required to be paid and therefore give no directions in that regard.

179.        We therefore determine Issue 3 in favour of the Authority.

 

 

 

 

                                              TIMOTHY HERRINGTON

 

TRIBUNAL JUDGE

 

         RELEASE DATE: 27 NOVEMBER 2019

 

This decision has been amended and reissued under Rule 40 correcting accidental typographical slips